- Implement comprehensive tests for the ticket board provider to validate kanban and pipeline modes, including ticket movement and error handling.
- Create tests for ticket status settable to ensure proper status selection logic.
- Enhance web form model tests to cover ticket-specific fields and submission behavior.
- Introduce CSV import sheet tests to verify file handling and error reporting.
- Add deal aging badge tests to confirm correct display of aging statuses.
- Implement tickets selection tests to ensure UI responsiveness and functionality at various screen sizes.
- Implement tests for web forms screen to ensure proper rendering and behavior on different devices.
- Create unit tests for web form model to validate JSON serialization and deserialization.
- Add tests for web forms provider to verify API interactions and state management.
- Ensure that publishing rules and field validations are correctly enforced in the tests.
- Removed unused imports and cleaned up test files for better readability.
- Updated `FRONTEND_URL` handling in `crm/settings.py` to enforce absolute URL requirements in production environments, preventing dead links in emails.
- Added comprehensive tests for `FRONTEND_URL` validation to ensure it does not accept loopback addresses or non-absolute URLs outside of development.
- Improved documentation to clarify the purpose and requirements of `FRONTEND_URL` in the context of email links and deployment.
- Updated dependencies in `pyproject.toml` and `uv.lock` to include `ruff` for enhanced linting capabilities.
- Removed serialization of full account, contact, lead, and opportunity objects from the dashboard API response.
- Added new fields for urgent counts, pipeline by stage, revenue metrics, hot leads, tasks, activities, and goal summary.
- Updated the context building logic to only include counts and essential data.
Enhance JWT signing key validation in settings
- Added a check to ensure the SECRET_KEY is at least 32 bytes for HS256 JWT signing.
- Introduced warnings for development environments when the key is shorter than required.
Update environment variable documentation
- Clarified the requirements for the SECRET_KEY in the environment variables documentation, emphasizing the minimum length for security.
Revise mobile app API configuration for self-hosting
- Updated the mobile app to allow self-hosting by using `--dart-define` for API_BASE_URL and GOOGLE_SERVER_CLIENT_ID.
- Ensured that the app enforces HTTPS in release builds to secure JWT transmission.
Implement entity lookup for task linking in mobile app
- Created a new EntityLookup model to handle task attachments to accounts, leads, opportunities, and tickets.
- Refactored task form screen to utilize the new lookup mechanism, improving the user experience by providing real-time loading states and error handling.
Add unit tests for new features and configurations
- Implemented unit tests for API configuration, entity lookup, and task link picker to ensure functionality and reliability.
- Updated the `ORG_SCOPED_TABLES` to clarify the exclusion of `security_audit_log` and its implications for RLS policies.
- Added tests to ensure `security_audit_log` remains unexposed and verify the absence of RLS policies.
- Implemented tests for HSTS settings behind a TLS-terminating proxy to ensure proper header emission.
- Enhanced notification API tests to enforce RLS context during notification creation and access.
- Adjusted notification model tests to ensure RLS context is correctly applied for cross-tenant scenarios.
- Refined RLS context management in `conftest.py` to ensure proper session handling across tests.
- Removed deprecated Salesforce settings from the frontend and updated documentation to reflect changes in API behavior.
- Cleaned up environment variable documentation to clarify the impact of `TRUST_PROXY_SSL_HEADER` and other settings.
- Replaced custom admin check with `is_org_admin` in `custom_field_views.py`, `organization_views.py`, `user_views.py`, and `macros/views.py` for consistency and clarity.
- Removed the unused `_is_admin` function from `custom_field_views.py` and `macros/views.py`.
- Updated organization-related views to streamline admin checks and improve error handling.
- Removed `SWAGGER_ROOT_URL` and `GOOGLE_REDIRECT_URI` settings from `settings.py` as they were not utilized.
- Cleaned up Swagger parameters across various modules to remove the now-irrelevant `org` header.
- Adjusted documentation to reflect the removal of `GOOGLE_REDIRECT_URI` and clarify Google OAuth configuration.
- Added database indexes for `Order` and `OrderLineItem` models to improve query performance.
- Introduced tests for frontend URL generation in `test_client_links.py` to ensure all links in emails are reachable and correctly formatted.
- Added authorization tests for deleting attachments in `test_attachment_delete_authz.py` for leads and opportunities, ensuring proper access control based on user roles and organization boundaries.
- Updated `LeadAttachmentView` and `OpportunityAttachmentView` to use `get_scoped_or_404` for safer object retrieval, preventing unauthorized access to attachments across organizations.
- Improved documentation regarding the organization API key and personal access tokens, clarifying their scopes and security implications.
- Enhanced frontend token management to support new scope enforcement, allowing users to specify access levels when creating tokens.
- Removed the `/api/notifications/stream/` endpoint and associated SSE logic.
- Updated `Bell.svelte` and `notifications.svelte.js` to implement polling for notifications every 45 seconds.
- Introduced connection pooling configuration in environment variables documentation.
- Updated production deployment documentation to recommend WSGI over ASGI for improved database connection management.
- Created production-deploy.md to outline production deployment steps and configurations.
- Added requirements.md detailing environment prerequisites for self-hosting.
- Introduced security-hardening.md as a checklist for securing multi-tenant deployments.
- Developed troubleshooting.md to address common issues in RLS-backed deployments.
- Configured mkdocs.yml for documentation structure and navigation.
